API Gateway OAuth Enhancements — OIDC Standards Compliance
Two significant enhancements enhance Workato API Gateway’s alignment with OIDC standards.
- Public API Endpoints — API collections can expose unauthenticated endpoints with no access profile or credentials required, enabling standards-compliant discovery documents like /.well-known/openid-configuration (OIDC) and /.well-known/smart-configuration (SMART on FHIR). A clear warning is shown when configuring public endpoints to prevent accidental exposure.
- Custom Claims and Scopes Validation — Access Profiles can be resolved through OIDC token claims with no IdP modification required, enabling enterprise customers with locked-down shared IdPs — PingFederate, Okta, Azure AD, ADFS — to integrate end-to-end without involving their IdP admin teams.
- Clients Tab Renamed to Applications — The API Keys tab under Clients is now called Applications, reflecting support for multiple credential types beyond API keys alone.
Learn more in API Platform.